mccalltd/AttributeRouting — Issue #16: A potentially dangerous Request.Form value was detected from the client 
Author: Valamas
Created: 2011-10-26 08:48:05+00:00
State: open

Hi Tim,

Due to the dynamic nature of my application. I am unable to utilize the attribute [AllowHtml] on a model property to get a Request.Form value with an unsafe value.

Here is an example form

<b>Hello Html Tags</b>

I have two scenarios to accept the post. One without and one with AttributeRouting.

The first scenario works without AttributeRouting [project: Unvalidated.csproj]
[HttpPost]
public ActionResult Save()
{
string value = Request.Unvalidated().Form["txt"];
return View("Success");
}

This AttributeRouting version errors [project: ValidateInputFalse.csproj]
[POST("Home/Save")]
public ActionResult Save()
{
string value = Request.Unvalidated().Form["txt"]; // ERROR
return View("Success");
}

Here is the stack trace

A potentially dangerous Request.Form value was detected from the client (txt=" Hello Html TagsHello Html Tags

Also, I have uploaded a solution which contains the scenarios above. (sorry for the confusing project names).
https://skydrive.live.com/embedicon.aspx/Public/AttributeRouting^_InputValidation.zip?cid=e7737d00ff5b25e9&sc=documents

Thank you
Mike